Enforce complete replay output identities

[kattsushi]

Requested outcome

Make replay provenance complete and fail closed before any workspace output reads.

Motivation

The reusable App Builder generation kernel needs replay records to bind the full ordered output identity set. A record that is truncated, reordered, coherently re-digested, or paired with candidate identity drift must never reach host observation.

Expected behavior

• Bind path, mode, owner, and sourceDigest for every generated output.
• Reject stale or malformed recorded evidence before reading workspace outputs.
• Reject coherently re-digested reordered evidence at candidate identity binding.
• Reject candidate drift in every identity field before reads.
• Preserve valid zero-diff replay.

Acceptance evidence

• Focused replay tests pass 7/7.
• Generation package tests pass 20/20.
• Contracts build and generation typecheck pass.
• Format and diff checks pass.
• All rejection controls assert zero workspace reads.
• The work unit remains below 400 changed lines.

Scope

This is Delivery Unit 1 of #131. It covers replay completeness only; catalog, package surfaces, Todo generation, compatibility migration, public proof, and PR #130 regeneration remain separate delivery units.

[kattsushi]

Closing as not planned because Effectify App Builder has been retired in favor of contributing to lloydrichards/stack-effect. No App Builder implementation is retained on dev.